Users & Groups

The person who set up Docker Manager is its owner. The owner can do everything and is the only one who manages people, under Access in the menu. Nobody can sign up on their own.

Invite someoneCopy Anchor Link

1. Open Access and press Invite User.
2. Under Groups, choose the groups the new account joins, if any.
3. Press Create Invite Link, copy the link and send it yourself. Docker Manager doesn't email it.

The link works once and expires after 72 hours by default. Under Options you can set Expires After (Hours), or an Email that alone may use the link. The person opens it, chooses a username and password, and presses Create Account. With single sign-on they can press Continue with and the name of your identity provider instead. You then get an alert that links to the new account. The Invitations tab lists your links and their groups; Revoke stops an unused one.

GroupsCopy Anchor Link

A person can be in several groups, and the groups' permissions decide what they may do. A new account is only in the groups its invitation names; without a group it can do nothing until you add it to one or give it overrides. Docker Manager starts without groups: create the ones you need.

• Create Group makes a new group. It starts at the bottom of the list.
• Drag a group by its handle to change its priority (see Permissions).
• Add Members on a group's page adds people to it at once; the remove button next to a member takes them out of that group only, after you confirm. A group without members also offers Invite User, with the group already chosen.
• A group's menu can Rename Group or Delete Group (only an empty group).

Manage a personCopy Anchor Link

Open a person under Access to see their Groups, in priority order, and their Sessions. Add to Group adds them at once; the remove button next to a group takes them out of it, after you confirm. The Account Actions menu (⋯) has:

• Edit Details changes their display name and email address (also yours).
• Disable Account signs them out and revokes their API tokens. Enable Account lets them back in.
• Reset Sign-In Factors removes their authenticator app, passkeys and recovery codes.
• Create Password Reset Link makes a one-time link to send them.
• Remove Single Sign-On Link unlinks their account from your identity provider and signs them out.
• Sign Out Everywhere or Delete Account.

The owner account can't be disabled or deleted. If the owner forgets the password, Are you the owner? on the sign-in page leads to the recovery steps.

Your accountCopy Anchor Link

Click the round button with your initial at the top right and choose Profile:

• Change Password. Passwords need at least 15 characters, unless the owner changed this in the sign-in policy.
• Set Up Authenticator App, then Show Setup Code, to enter a code after your password, or Add Passkey to sign in with your fingerprint, face or PIN instead of a password.
• Create New Codes: 10 recovery codes for when you lose your authenticator app or passkey.
• Sessions lists the devices you are signed in on. Sign Out next to one signs it out at once.
• Single Sign-On shows whether your account is linked to your identity provider.

Some changes, such as creating an API token or changing the sign-in policy, first ask you to Confirm It's You with a passkey, an authenticator code or your password. To switch, choose Use an Authenticator Code Instead, Use a Passkey Instead or Use Your Password Instead; your browser remembers your choice. A linked account can also choose Use Single Sign-On Instead: your identity provider opens in a new window and asks you to sign in again. A confirmation lasts 10 minutes.

You are signed out when you close the browser, after 8 hours without activity and after 24 hours at most. On your own computer, check Stay Signed In to stay signed in for up to 30 days without activity and a year at most.

Passkeys belong to one address: after Docker Manager moves to a new address, sign in with your password and authenticator code (or a recovery code) and add your passkeys again.

Sign-in policyCopy Anchor Link

The owner sets the rules for everyone under Settings → Sign-In Policy. Each card saves on its own with Save Changes:

• Sign-In Factors: what every account signs in with, from Password or Passkey to Authenticator App and Passkey. Each choice says what it asks for. Accounts that lack a required factor get a limited session to add it, for Time to Add Required Factors (Hours).
• Passwords: turn on Set a Minimum Length to choose a Minimum Length from 8 to 64; when it is off, 8 characters are enough. Common and breached passwords are always refused.
• Single Sign-On: see below.
• Staying Signed In: whether the sign-in page offers Stay Signed In.
• Invite and Reset Links: how long invite links and password reset links work.

Changing the sign-in factors signs everyone else out; Docker Manager lists what happens before it saves. Whether API tokens are allowed is set under Access → API Tokens.

Single sign-onCopy Anchor Link

People can sign in with an OpenID Connect identity provider, such as Pocket ID, Authentik or Keycloak.

1. Open Settings → Sign-In Policy and press Set Up Single Sign-On. Copy the Redirect URL, for example https://docker.example.com/sign-in/single-sign-on.
2. At your identity provider, create an OpenID Connect client for Docker Manager with that redirect URL. In Pocket ID, this is an OIDC client with that callback URL.
3. Back in Docker Manager, enter the Issuer URL (in Pocket ID, its address), the Client ID and the Client Secret. Leave the secret empty for a public client. A Provider Name labels the button.
4. Press Set Up Single Sign-On. Docker Manager checks that it can reach the identity provider first.

The sign-in page now offers Sign In with and the provider's name. Edit on the Single Sign-On card changes the provider; Turn Off stops offering single sign-on.

Bring existing accounts alongCopy Anchor Link

Turn on Link Accounts by Verified Email and press Save Changes. The first time someone signs in with single sign-on, they get the account with the same email address, if the identity provider says the address is verified. From then on the account stays linked to that person at the identity provider, even if their email address changes. An account without an email address gets one with Edit Details.

Single sign-on onlyCopy Anchor Link

1. Sign out and sign in with single sign-on once, so your own account is linked.
2. Under Sign-In Methods, choose Single Sign-On Only and press Save Changes.

Everyone else is signed out. Passwords, passkeys, recovery codes and password reset links stop working, and so do the API tokens of accounts that aren't linked yet. Invite links work with single sign-on only. Your identity provider decides how people sign in, so the sign-in factor and password rules are hidden until you allow passwords again.

Good to know:

• The single sign-on settings on the server can set the identity provider instead. The app then shows it, but can't change it.
• Signing out of Docker Manager doesn't sign you out of your identity provider.
• Someone you remove at your identity provider can't sign in again, but stays signed in until their session ends: use Sign Out Everywhere or Disable Account.